Cut what the audit found: dead columns, one-time upgrades, three deps

Works through TODO.md from the 2026-09-12 over-engineering audit. Drops the
entries.read/flagged/position columns (migrate() removes them from older
databases), migrate_opml_children, the legacy interval_mins key, the
contrib/ systemd units, test-only Db wrappers, a duplicate token generator,
redundant logbuf visitors, unused page state and CSS, and the infer, dirs
and tokio-stream dependencies. The icon is served once as /icon.png instead
of inlined four times, taking about 94 KB off the two pages.

The adoption's subscription half was not dead: it gives a fresh install's
first admin the config's feeds. It stays as adopt_catalogue, now tested.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TAC7sLVqfKmY6rsTLXzNgk

TODO.md

@@ -1 +1,30 @@
 # To do
+
+## Cut what is no longer needed
+
+From a whole-repo audit for over-engineering on 2026-09-12. Biggest cut first.
+
+- [x] **Pre-accounts adoption and the dead `entries` columns.** The copy of the old read state into
+  `entry_state` and the `entries.read`, `flagged` and `position` columns are gone. Its other half,
+  subscribing the first admin to the catalogue, was not dead and stays as `adopt_catalogue`.
+  (`src/db.rs`, `src/main.rs`)
+- [x] **`contrib/` systemd units.** From before the container; nothing points at them.
+- [x] **`migrate_opml_children`.** A one-time move of OPML children out of `config.toml` that has
+  run. Delete it and its call. (`src/main.rs`)
+- [x] **The legacy `interval_mins` key.** Production uses `schedule`. Delete the field, the fallback
+  in `General::interval` and its test. (`src/config.rs`)
+- [x] **`Db::entries` and `Db::count_entries`.** One-line wrappers only the tests call; the tests
+  call `entries_in` and `count_in` instead. (`src/db.rs`)
+- [x] **`web::generate_token`.** Repeats `auth::new_session_token`. Use that. (`src/web.rs`)
+- [x] **Page leftovers.** `globalEvery`, `S.busy`, `S.limit`, `unitOptions`' `firstLabel`, `--r`,
+  `.ep.open`, the phone `.ep .art`, the duplicate phone `.fhead.slim{flex-wrap}`, the second
+  `#sidebar{z-index}`, and the `on()` helper. (`web/index.html`)
+- [x] **`logbuf` visitors.** `record_i64`, `record_u64` and `record_bool` repeat what `Visit`'s
+  defaults already do through `record_debug`. (`src/logbuf.rs`)
+- [x] **The `infer` dependency.** Its torrent check is the `d8:announce` test on the next line.
+- [x] **The `dirs` dependency.** `XDG_CONFIG_HOME`, `XDG_DATA_HOME` and `HOME` from `std::env`.
+- [x] **The `tokio-stream` dependency.** `futures_util::stream::unfold` over the broadcast receiver.
+- [x] **The icon inlined four times.** About 94 KB of base64 across both pages; serve it once as
+  `/icon.png` from `include_bytes!`, open without signing in like `/login`.
+
+After these: `cargo test`, `node tests/page-smoke.js`, `npx playwright test`.